lkml.org 
[lkml]   [2011]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device
Date
On Thursday, November 10, 2011, 함명주 wrote:
> Sender : Axel Lin<axel.lin@gmail.com> Date : 2011-11-10 16:28 (GMT+09:00)
> > In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
> > Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.
> >
> > Signed-off-by: Axel Lin <axel.lin@gmail.com>
>
> Thank you for finding that out.
>
> Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>

Applied to linux-pm/pm-fixes.

Thanks,
Rafael


> > ---
> > drivers/devfreq/devfreq.c | 8 ++++++--
> > 1 files changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
> > index d065925..59d24e9 100644
> > --- a/drivers/devfreq/devfreq.c
> > +++ b/drivers/devfreq/devfreq.c
> > @@ -418,10 +418,14 @@ out:
> > */
> > int devfreq_remove_device(struct devfreq *devfreq)
> > {
> > + bool central_polling;
> > +
> > if (!devfreq)
> > return -EINVAL;
> >
> > - if (!devfreq->governor->no_central_polling) {
> > + central_polling = !devfreq->governor->no_central_polling;
> > +
> > + if (central_polling) {
> > mutex_lock(&devfreq_list_lock);
> > while (wait_remove_device == devfreq) {
> > mutex_unlock(&devfreq_list_lock);
> > @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
> > mutex_lock(&devfreq->lock);
> > _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
> >
> > - if (!devfreq->governor->no_central_polling)
> > + if (central_polling)
> > mutex_unlock(&devfreq_list_lock);
> >
> > return 0;
>
> MyungJoo Ham (함명주)
>
> Mobile Software Platform Lab,
> Digital Media and Communications (DMC) Business
> Samsung Electronics
> cell: +82-10-6714-2858 / office: +82-31-279-8033

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2011-11-15 00:17    [W:0.027 / U:7.844 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site